ipa-4.5.4-10.3.0.1.el7.AXS7

Asianux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

* During the installation of Identity Management replicas, setting up the Custodia component sometimes failed because of missing objects in the Directory Server database. Consequently, the whole "ipa-replica-install" command failed. With this update, the "nsds5ReplicaReleaseTimeout" setting can be added to the LDAP servers on the replication masters to avoid the Custodia setup failure. The setting defines how long a replication master should send updates to the new replica before it terminates its replication session. The termination then allows other replication masters to update the new replica. As a result, "ipa-replica-install" proceeds correctly. (#1579189)

* When an Identity Management (IdM) host is promoted to a replica, IdM uses Custodia to transport secrets, for example Certificate Authority keys. Previously, Custodia uploaded the newly created public keys of the IdM host to the local LDAP server and then connected to one or two remote Custodia instances to check if the keys had been replicated there. Consequently, on a busy LDAP cluster the replica installation sometimes timed out. With this update, Custodia directly uploads its key to a remote IdM master and uses this remote IdM master to request all secrets. As a result, retrieval of secrets no longer depends on timely replication between local and remote LDAP servers. (#1579190)

* Previously, the *ipa-server-upgrade* utility did not check if a Certificate Authority (CA) instance was configured on the IdM host and tried to back up configuration files that exist only on IdM masters with a CA instance. Consequently, *ipa-server-upgrade* failed because of the missing files. With this update, *ipa-server-upgrade* checks if a CA instance is configured on the IdM host before trying to back up CA configuration files. As a result, *ipa-server-upgrade* works as expected. (#1579203)

Users of ipa are advised to upgrade to these updated packages.